WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory has 17 disclosed vulnerabilities in the WordSec catalog, reported between 2021 and 2026; all 17 are fixed as of October 2026. Their average CVSS score is 5.8, and the most serious one scores 8.1 out of 10. Severity breakdown: 0 critical and 6 high. 2026 was the busiest year with 10 disclosures.
The most common weakness is Missing Authorization, behind 7 of the records (41%). Other recurring categories include Improper Privilege Management, Path Traversal.
Every one of the 17 issues recorded for WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory has a vendor fix available, so running the current release closes all known holes.
15 independent researchers contributed these findings, most of them (2) reported by Ananda Dhakal. WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2026-49766WP User Manager – User Profile Builder & Membership <= 2.9.16 - Authenticated (Subscriber+) Arbitrary File Deletion
Read the full analysisVulnerability Records

WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory
Author
WP User Manager
User registration, login, profiles and member directories for WordPress WP User Manager replaces the default WordPress login and registration with forms that live on your own pages and match your theme. Members get a public user profile and an account page to edit their details, and you can list them in a searchable member directory. Use it to build a membership site, a community, a client portal, or simply a better registration form and login page than WordPress gives you out of the box. What you can build with the free plugin: A custom registration form on any page, with your own user fields, terms and privacy checkboxes, and automatic login after signup A front-end login form and login page, with password recovery, so users never see wp-login.php User profile pages with custom avatars, cover images and tabs for each member’s posts and comments A member directory with search, sorting and filtering by role, displayed anywhere with a block or shortcode An account page where members update their details and change their password Paid registration with Stripe, collecting a one-off or recurring payment when someone signs up Content restriction by role or logged-in status, on whole pages or on any individual block, plus custom redirects after login, logout and registration Blocks and Elementor widgets for every form and page: login, registration, password recovery, account, profile, profile card, user directory, recently registered users, and login and logout links. Shortcodes work everywhere else Website | Addons | Documentation | Support Features included Frontend forms: Allow users to register and login from the front of the site. Customize the registration form with custom fields to collect data Stripe integration: Take one-off or recurring payments on the registration form, using Stripe Connect Custom email notifications: Customize the emails sent to users when the register, reset their password and more Custom avatars: Users can edit their site avatar by uploading an image from the account page Elegant user profiles: All users have a public profile page to display their data Shortcodes editor: Easily add the plugin shortcodes to pages or posts with the shortcode generator and editor Roles editor: Edit roles and their capabilities. Create new roles and duplicate existing ones Beautiful user directories: Display users in a directories that can be displayed anywhere on the site SEO URLs: All the URLs are SEO friendly Content restriction: Restrict content for certain users, by logged in status, or by role Passwords management: Allow users to update their password from their account page Custom fields editor: Create custom user fields that can be used to collect data on registration Custom widgets: Display user data and forms in sidebars using widgets Custom redirects: Control where the users are redirected to on login, registration and more Powerful tools: Tools to be in control of your site and who registers Developers friendly: Customize and integrate with other plugins with a large number of hooks and filters Extensive documentation: Full documentation and expert support Translation Ready – The plugin and addons are fully localized ready for translation Read more about our features on wpusermanager.com Premium Features For more advanced functionality check out the pricing page. Custom Fields: Add custom fields to members profiles and registration forms WooCommerce: Integration with WooCommerce. Collect payment at registration, allow members to update their billing and shipping addresses, display product purchases, reviews and more! Stripe Pro: Integration with Stripe. Collect payment at registration with Stripe, restrict access to your site, remove the commission fees. User Verification: Send a verification link via email upon registration or manually approve users before they can login Groups: Give your users the ability to create and join groups Security: Add password security features and user login management features Registration Forms: Create unlimited registration forms, create multi-step forms, customize forms with HTML, and have full control over form settings Frontend Posting: Allow your users to submit posts and other content from the frontend Advanced Custom Fields: Collect ACF user data at registration and allow users to see and edit the data on their profile Social Login & Registration: Allow your users to quickly login and register with their favorite social network account, Facebook, Twitter, Instagram & LinkedIn Private Content: Provide private content for all your users, as well as user specific content so you can tailor for each member Mailchimp: Sync users with Mailchimp upon registration & more Google reCAPTCHA: Stop spam registrations on your website for free Content Restriction Plus: One-click restriction to posts, pages and custom post types Likes: Allow your users to like posts, pages and other content hCaptcha: Stop more bots. Start protecting user privacy with hCaptcha WPML: Translate your custom fields, field groups, registration forms, and emails using WPML Personal Data: Allows the user to request an export of personal data and request erasure of personal data from the account page for GDPR compliance Delete Account: Allows the user to delete their own profile from the frontend account page Free Extensions Newsletter: Subscribe your members to your Newsletter plugin lists easily during registration Username Length: Set minimum and maximum characters length for usernames Translations Want to add a new language to WP User Manager? Awesome! You can contribute via translate.wordpress.org. Please read the official translation tutorial for more information. Support Support is provided only through the support forum. Join the support forum to ask questions and get help regarding WP User Manager. Free support is provided exclusively for bugs and help using the plugin. Please read the support policy https://wpusermanager.com/support-policy/. Before opening a support topic please read the faqs and documentation. Support for premium addons is provided exclusively through the premium support platform. Support for premium addons cannot be provided through WordPress.org due to the rules put in place by the WordPress.org team.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C